Create user log

[Patrick Chim]

Hi,

I am using HP-UX 11i with trusted system. If I create an unix account using useradd or through SAM, is there any logging that I can trace back the creation date of such account for auditing purpose ?

Regards,
Patrick

[Darren Prior]

Hi Patrick,

If you use SAM then this will be logged within the samlog. Otherwise, it's not something that would explicitly be captured by auditing - but auditing would show the home dir being created, and the passwd file being accessed.

regards,

Darren.

[Cheryl Griffin · Accepted solution]

At 11i useradd/mod/del and groupadd/mod/del were added to self-auditing records which means that you can obtain information on their use.

You need to apply the patch though:
PHCO_27049 s700_800 11.11 audit(5) man page patch

This patch addresses SR:8606245587
The commands: useradd, usermod, userdel, groupadd, groupmod and groupdel have been updated to make them self audited
commands, using the standard HP-UX auditing subsystem. The audit(5) man page does not list these commands as self audited commands.
Resolution:
The audit(5) man page has been changed to list the comamnds: useradd, usermod, userdel, groupadd, groupmod and groupdel as self audited commands.